Oracle Siebel CRM CVE-2026-101400

Exploitation requires the attacker to first have an authenticated logon to the server infrastructure/host on which Siebel Apps - Marketing (versions 17.0 through 26.9) executes - this is a local-access precondition, not remote network reach, despite the PR:N metric. It further requires satisfying HIGH attack-complexity conditions (AC:H), meaning difficult, non-deterministic timing/state circumstances the attacker does not fully control. Limiting factors: local infrastructure access is mandatory, the attack is hard to reliably reproduce, and the maximum impact is only a PARTIAL denial of service of the Marketing component with no confidentiality or integrity loss, keeping real-world risk low.

This is a genuinely low-priority issue, and the signals are consistent in that direction. The CVSS 3.1 base score is 2.9 (Low), driven entirely by a partial availability impact (A:L) with no confidentiality or integrity effect. The vector (AV:L/AC:H/PR:N/UI:N/S:U) describes a LOCAL attack vector with HIGH attack complexity, meaning the attacker must already have a logon to the infrastructure/host where Siebel Apps - Marketing runs and must win difficult, non-deterministic conditions to succeed. Although PR:N technically indicates no application privileges are required, Oracle's own description qualifies this as an 'unauthenticated attacker with logon to the infrastructure where Siebel Apps - Marketing executes' - so PR:N should not be read as remote-unauthenticated; infrastructure access is a hard prerequisite that substantially limits exploitability. No EPSS score, CISA KEV listing, POC, or SSVC data is present in the input. There is no evidence of exploitation: no public exploit identified at time of analysis. The worst realistic outcome is a partial, likely transient denial of service of the Marketing component - not code execution or data exposure. Net: a low-CVSS, low-real-risk issue that should be remediated through normal Oracle Critical Patch Update cycles rather than emergency patching.

An actor who already holds a login on the server infrastructure hosting Siebel Apps - Marketing repeatedly triggers a resource- or logic-exhaustion condition in the Marketing component under specific, hard-to-reproduce timing or state conditions (reflecting the HIGH attack complexity). Success degrades or partially interrupts the availability of the Marketing component for other users. No public exploit code is identified at time of analysis, and there is no indication of active exploitation.